linux hack

[Corch <corch () INFOSOURCE COM AU>]

I was recently called out to a site run by an aquaintence of mine to have
a look at some machines that were causing some problems. On rebooting one
of the machines I saw the following messages

INIT: entering run level 3
/bin/nice ./scan.sh not found
/bin/nice ./hack.sh not found


I'm almost certain the box has been rootkit'd, im just not sure which one,
anyone able to give me some clues?

Corch